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Market Share Leadership of the Year, Vulnerability Assessment 
Global, 2010 


Frost & Sullivan’s Global Research Platform 


Frost & Sullivan is entering its 50 year in business with a global research organization of 
1,800 analysts and consultants who monitor more than 300 industries and 250,000 
companies. The Company’s research philosophy originates with the CEO’s 360 Degree 
Perspective,* which in turn serves as the foundation of its TEAM Research** methodology. 
This unique approach enables us to determine how best-in-class companies worldwide 
manage growth, innovation and leadership. Based on the findings of this Best Practices 
research, Frost & Sullivan is proud to present the 2010 Global Market Share Leadership of 
the Year Award in Vulnerability Assessment to Qualys, Inc. 


Key Industry Challenges Addressed by Increased Market Share 

Vendors in the vulnerability assessment market face countless challenges. The market is 
maturing as these solutions are widely distributed. Vendors are running out of new 
customer prospects, a situation that can lead to stunted market growth. This high level of 
market saturation will force increased levels of competition, as growth for any particular 
vulnerability assessment vendor will come at the expense of its competitors. These 
challenges are compounded by the relatively stagnant level of technological innovation in 
this market. Network vulnerability scanners are very mature and have undergone very few 
changes in recent years. Now, vendors focus primarily on expanding their databases of 
known vulnerabilities to check for. 


Companies that are able to develop and execute innovative strategies will be very capable 
of growing at a rate that is higher than that of its competitors. This will result in increased 
market share and can be utilized as a method of measuring the company’s success. Frost & 
Sullivan feels that the company that garners the greatest share of market will be recognized 
as providing the best combination of quality products, successful strategy, and customer 
value. This recognition will enable the company to earn customer confidence and rise to the 
top of customers’ shortlists of vulnerability assessment vendors. This will also increase the 
company’s ability to compete in terms of new deals, as well as in competitor-displacement 
opportunities. Finally, because the market leader’s success is closely related to its product, 
the market leader will set the bar for competitors’ technologies. The market leader must 
continue to innovate and raise this bar in order to remain on top. 


Impact of Market Share Leadership of the Year Award on Key Stakeholders 

The Market Share Leadership of the Year Award is a prestigious recognition of Qualys’ 
accomplishments in the vulnerability assessment market. An unbiased, 3™ party 
recognition can provide a profound impact in enhancing the brand value and thereby 
accelerating Qualys’ growth. As captured in Chart 1 below, by researching, ranking, and 
recognizing those who deliver excellence and best practices in their respective endeavors, 
Frost & Sullivan hopes to inspire, influence, and impact three specific constituencies: 
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e Investors 
Investors and shareholders always welcome unbiased and impartial third party 
recognition. Similarly, prospective investors and shareholders are drawn to 
companies with a well-established reputation for excellence. Unbiased validation is 
the best and most credible way to showcase an organization worthy of investment. 


e Customers 
3rd party industry recognition has been proven to be the most effective way to 
assure customers that they are partnering with an organization that is leading in its 
field. 


e Employees 
This Award represents the creativity and dedication of Qualys’ executive team and 
employees. Such public recognition can boost morale and inspire your team to 
continue its best-in-class pursuit of market leadership for Qualys. 


Chart 1: Best Practices Leverage for Growth Acceleration 
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Best Practice Award Analysis for Qualys, Inc. 


The Frost & Sullivan Award for Market Share Leadership of the Year is presented to the 
company that has demonstrated excellence in capturing the highest market share within 
its industry. The Award recognizes the company's leadership position within the industry 
in terms of revenues or units, as specified. 


Qualys’ Performance in the Vulnerability Assessment Market 


Qualys has achieved great success in recent years with high growth rates that have enabled 
the company to capture the greatest share of the market in 2009. Chart 2 demonstrates 
Qualys’ market share compared to that of other competitors. The vulnerability assessment 
market includes solutions that allow organizations to conduct network-based, credentialed 
scans of enterprise networks to find security flaws on all devices with IP addresses. Some 
vendors may offer an endpoint agent; however, this should be optional. Due in part to the 
industry-wide trend of integration, vulnerability scanners can now assess databases, Web 
applications, and configurations, while also providing patch management capabilities. 
However, vulnerability scanning should still be the primary focus of the product. Vendors 
that only offer this as an integrated part of a more broadly-focused security suite, and do 
not offer this functionality separately, are not included. 


Chart 2: Vulnerability Assessment Market — Market Share by Vendor (World), 2009 
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Key Performance Drivers for Qualys 


The vulnerability assessment market faces a number of challenges such as a high product 
diffusion rate and mature technology. Frost & Sullivan’s research shows that Qualys has 
been able to grow at a rate that far surpasses that of its competitors as a direct result of 
leadership in multiple areas. Not only is this continued excellence critical for Qualys’ success 
aS a company, but Qualys’ leadership is driving the vulnerability assessment market’s 
growth as well. 


Factor 1: Product Strategy Leadership 


The QualysGuard IT Security and Compliance Suite enables large enterprises and small- to 
medium- sized businesses to automate the process of vulnerability management and policy 
compliance. This suite includes key functions in this process such as network discovery, 
inventory and mapping, vulnerability scanning for both systems and web applications, with 
remediation guidance and workflows. QualysGuard enables organizations to achieve 
compliance with external regulations as well as internal security goals by automating critical 
security tasks such as auditing, enforcement, and documentation. The suite also offers an 
automated PCI compliance validation solution for retail companies, and a suite of solutions 
for Web application security, including the recently introduced malware detection service for 
web sites along with the security seal known as Qualys Secure. 


Ease of Use, Deployment, and Maintenance 


QualysGuard is available as a Software-as-a-Service solution, a model that has been central 
to the company’s success. This delivery model allows customers to achieve security and 
compliance goals as rapidly as possible. Set-up is efficient and easy as customers are not 
required to perform any software installation or maintenance, and QualysGuard can be 
accessed from any Web browser through a Secure Web Interface. Hardened client-side, 
plug-in appliances are available when necessary for internal scanning. Furthermore, Qualys 
adds new vulnerability signatures and compliance controls daily and major product features 
are added quarterly. This model ensures that customers will always receive the latest 
updates about the newest threats. 


Frost & Sullivan notes that this cloud-based solution enables far superior scalability 
compared to on-premise solutions. Qualys Internet scanners utilize inference-based 
assessments in order to perform only the tests that are relevant to the host system. Qualys’ 
Secure Operations Centers utilize a multi-tiered architecture of load-balanced scanner 
appliances in order to provide fast scanning, processing, and secure storage of vulnerability 
data. Qualys boasts one of the largest deployments in the vulnerability management market 
at a Fortune Global 50 company. 


Lower Total Cost of Ownership 
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QualysGuard is available to customers as an annual subscription model, or customers may 
pay per IP address scanned. By comparison, competing vulnerability assessment solutions 
are available as either physical appliances or enterprise software (including virtual 
appliances). These solutions are much more costly, as customers must renew the product 
license on a regular basis (yearly or multiple years), or purchase a very expensive perpetual 
license. Comparatively, the Qualys subscription shifts customer expenditures from a capital 
investment to a much more affordable and predictable operational cost. 


Successful SaaS Business Model 


This SaaS model has been central to Qualys’ success. Qualys has grown at a compound 
annual growth rate (CAGR) of 43.4% from 2003 to 2009 thanks in large part to these on- 
demand security services. Today, more than 5,000 organizations in 85 countries, including 
45 of the Fortune Global 100, utilize QualysGuard for addressing IT security and compliance 
initiatives. QualysGuard performs more than 500 million IP audits per year. 


Factor 2: Adaptation to Market Trends 
Identification of Greenfield Opportunities 


A key trend in the vulnerability assessment market has been the consolidation of security- 
related scanning technologies. This is crucial for vendors in the rapidly maturing 
vulnerability assessment market place. Qualys quickly recognized the need to move beyond 
vulnerability assessment and now focuses on providing a much more complete IT security 
and compliance solution. Qualys is now seeing new services such as Policy Compliance and 
Web Application Scanning providing a new vector of growth. These services represented 6% 
of revenues in 2009 and are currently showing double digit growth. 


Factor 3: Continued Security Portfolio and Product Development 
Security Portfolio Expansion 


Qualys expanded its security portfolio in 2010 with the addition of Qualys SECURE Seal. This 
is a service that scans customer Web sites for a minimum level of security, and upon 
achieving a passing score, the customer is awarded a Qualys seal. This service scans 
Websites for vulnerabilities, unsecured Web applications, malware, and the use of current 
SSL certificates. The Qualys SECURE Seal is only granted to Websites that are safe for 
customers, or fixed within the grace period, should a security issue be found. 


In addition, Qualys announced Malware Detection as a free service for Web sites of any size. 
QualysGuard Malware Detection utilizes static analysis and behavioral analysis techniques to 
accurately detect malware and provide in-depth reports. This will further increase Qualys’ 


visibility and help it to continue growing its market share. 


Product Enhancements 
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Qualys continues to add features to its vulnerability management solution. One of the latest 
additions, QualysGuard Patch Report improves the solution’s ability to create focused 
reports with actionable remediation guidance. This will enable customers to efficiently 
correct vulnerable systems while avoiding duplication of work. 


Factor 4: Strong Partnership Program 
Highly-Developed Partner Ecosystem 


QualysGuard is a highly scalable and open solution that allows easy integration with partner 
solutions. Qualys offers numerous partner benefits, such as joint account development, 
product trials, marketing materials, and lead-generation program. As a result, Qualys has a 
thriving and growing ecosystem of resellers, managed service providers, consultants, and 
technology partners. QualysGuard’s intuitive API’s facilitate integration with other leading 
security technologies. For these partners, Qualys represents a best-of-breed solution 
provider that has a strong reputation, visibility, and experience. 


In conclusion, Qualys is a privately held company with its latest round of financing in 
December 2004 that has achieved high growth rates. Qualys now leads in terms of market 
Share and is the only company delivering these services via a pure SaaS model. 


Based on the aforementioned factors, Frost & Sullivan is proud to present the 2010 Global 
Market Share Leadership of the Year Award in Vulnerability Assessment to Qualys, Inc. 


The CEO 360 Degree Perspective '™ - Visionary Platform for Growth 
Strategies 


The CEO 360 Degree Perspective model provides a clear illustration of the complex 
business universe in which CEOs and their management teams live today. It represents 
the foundation of Frost & Sullivan's global research organization and provides the basis on 
which companies can gain a visionary and strategic understanding of the market. The 360 
degree perspective is also a “must-have” requirement for the identification and analysis of 
best-practice performance by industry leaders. 


The 360 degree model enables our clients to gain a comprehensive, action-oriented 
understanding of market evolution and its implications for their companies’ growth 
strategies. As illustrated in Chart 3 below, the following six-step process outlines how our 
researchers and consultants embed the 360 degree perspective into their analyses and 
recommendations: 
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Chart 3: How the CEO's 360 Degree Perspective Model Directs Our Research 
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Critical Importance of TEAM Research 


Frost & Sullivan’s TEAM Research methodology represents the analytical rigor of our 
research process: it offers a 360 degree view of industry challenges, trends, and issues by 
integrating all 7 of Frost & Sullivan's research methodologies. Our experience has shown 
over the years that companies too often make important growth decisions based on a 
narrow understanding of their environment, leading to errors of both omission and 
commission. Frost & Sullivan contends that the successful growth strategies are founded 
on a thorough understanding of market, technical, economic, financial, customer, best 
practices and demographic analyses. In that vein, the letters T, E, A and M reflect our core 
technical, economic, applied (financial and best practices) and market analyses. The 
integration of these research disciplines into the TEAM Research methodology provides an 
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evaluation platform for benchmarking industry players and for creating high-potential 
growth strategies for our clients. 


Chart 4: Benchmarking Performance with TEAM Research 
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About Qualys, Inc. 


Qualys, Inc. is the leading provider of on demand IT security risk and compliance 
management solutions — delivered as a service. Qualys' Software-as-a-Service solutions 
are deployed in a matter of hours anywhere in the world, providing customers an 
immediate and continuous view of their security and compliance postures. The 
QualysGuard service is used today by more than 5,000 organizations in 85 countries, 
including 45 of the Fortune Global 100 and performs more than 500 million IP audits per 
year. Qualys has the largest vulnerability management deployment in the world at a 
Fortune Global 50 company. Qualys has established strategic agreements with leading 
managed service providers and consulting organizations including BT, Etisalat, Fujitsu, 
IBM, I(TS)2, LAC, NTT, SecureWorks, Symantec, Tata Communications and TELUS. The 
QualysGuard Security & Compliance Suite is available as an Enterprise Edition for large, 
distributed organizations and as an Express Edition for small to mid-sized business. 


About Frost & Sullivan 


Frost & Sullivan, the Growth Partnership Company, enables clients to accelerate growth 
and achieve best in class positions in growth, innovation and leadership. The company's 
Growth Partnership Service provides the CEO and the CEO's Growth Team with disciplined 
research and best practice models to drive the generation, evaluation and implementation 
of powerful growth strategies. Frost & Sullivan leverages almost 50 years of experience in 
partnering with Global 1000 companies, emerging businesses and the investment 
community from 31 offices on six continents. To join our Growth Partnership, please visit 


http ://www.frost.com. 
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